Config & defaults

Naming

• Field names are snake_case. Acronyms are lowercased: api_url, not apiURL.
• Currency-denominated fields end in _pusd. No bare numbers for money.
• Time-denominated fields end in _ms, _s, or _min. No bare numbers for durations.
• Percentage fields end in _pct. Range is 0..100, not 0..1.
• Basis-point fields end in _bps. Range is 0..10000.
• Boolean fields are positive: enabled, not disabled.

Defaults, warnings, hard limits

Every numeric parameter has three values: default, warning, hard. The bot must crash on init if its config violates a hard limit; it must emit a warning ReportEnvelope on every decision while a warning is breached.

Override precedence (highest wins)

1. Kill switch. Always wins.
2. Operator override (audited, time-bound, scoped).
3. Per-market override stored in BotConfig.
4. Strategy-level override.
5. Bot defaults.

Any override that survives a deploy must be reflected in the approved config. The Config Drift Detector flags drift on every reconcile.

Environments

• dev — synthetic markets only, never the live CLOB.
• staging — live CLOB read, simulated submission.
• prod_shadow — live read, decisions logged but never submitted.
• prod_advisory — decisions emitted to the operator dashboard, no submission.
• prod — full enforced submission.

Versioning

Every BotConfig carries configVersion. Any decision-affecting change bumps the version. The version is part of every emitted ReportEnvelope, so a decision is always traceable to the exact config that produced it.

Audit

Config changes are recorded as audit ReportEnvelopes carrying GOV_CONFIG_DRIFT when production differs from the approved baseline. The Config Drift Detector runs on every deploy and on a 5-minute heartbeat.